@@ -37,12 +37,12 @@ X-Content-Type-Options: nosniff <-----------
3737
3838## Key Features
3939
40- * Plug-n-Play: the default set of security headers can be enabled with ` security_headers on; ` in your NGINX configuration
41- * Sends ` X-Content-Type-Options ` only for appropriate MIME types, preserving unnecessary bits from being transferred for non-JS and non-CSS resources
42- * Plays well with conditional ` GET ` requests: the security headers are not included there unnecessarily
43- * Does not suffer the ` add_header ` directive's pitfalls
44- * Hides ` X-Powered-By ` , which often leaks PHP version information
45- * Hides ` Server ` header altogether, not just the version information
40+ * Plug-n-Play: the default set of security headers can be enabled with ` security_headers on; ` in your NGINX configuration
41+ * Sends ` X-Content-Type-Options ` only for appropriate MIME types, preserving unnecessary bits from being transferred for non-JS and non-CSS resources
42+ * Plays well with conditional ` GET ` requests: the security headers are not included there unnecessarily
43+ * Does not suffer the ` add_header ` directive's pitfalls
44+ * Hides ` X-Powered-By ` , which often leaks PHP version information
45+ * Hides ` Server ` header altogether, not just the version information
4646
4747## Configuration directives
4848
@@ -69,10 +69,10 @@ The values of these headers (or their inclusion) can be controlled with other `s
6969
7070Enables hiding headers which leak software information:
7171
72- * ` Server `
73- * ` X-Powered-By `
74- * ` X-Page-Speed `
75- * ` X-Varnish `
72+ * ` Server `
73+ * ` X-Powered-By `
74+ * ` X-Page-Speed `
75+ * ` X-Varnish `
7676
7777Next are the common security headers being set. It's worth noting that special value of ` omit ` for directives below
7878will disable sending a particular header by the module (useful if you want to let your backend app to send it).
0 commit comments